Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS > Networking > Flashcards

Networking Flashcards

1
Q

Security groups are attached to?

A

Elastic Network Interfaces (ENI) - and not instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

How do you explicitly block traffic within a VPC?

A

With NACLs. Security Groups do NOT support this.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which protocol and port operates BGP on?

A

TCP/179

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is number range for ASN within BGP?

A

0-65535

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Which ASN numbers within BGP are private?

A

64512-65534

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What’s iBGP?

A

Internal BGP - Routing within an Autonomous System (AS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

What’s eBGP?

A

External BGP - Routing between Autonomous Systems (AS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the “anycast IP addresses” of AWS Global Accelerator?

A

Two static IP addresses that serve as fixed entry point to an application hosted in one or more AWS region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What’s the max. bandwidth of a single VPN connection (with two tunnels)?

A

1.25 Gbps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What’s the max. bandwidth of a Virtual Private Gateway?

A

For VPN connections: 1.25 Gbps

For DX connections: same as the DX connection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What are valid attachments for AWS Transit Gateway (TGW)?

A

One, or more, of the following:

  • VPC
  • VPN
  • Direct Connect Gateway
  • Transit Gateway Peering
  • Transit Gateway Connect
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Do AWS Transit Gateway (TGW) support transitive routing?

A

Yes, if route tables are set up correctly

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are key features of AWS Transit Gateway (TGW)?

A

Transitive routing, cross region (via peering) and cross account support.

IMPORTANT: they are regional components, so have to be placed in a specific region and be peered to provide cross-region support. This also means that they fail if a complete region fails.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Up to how many route tables can a subnet have assigned?

A

1 (and always 1 as a subnet must always have a route table assigned)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What network elements can route tables be assigned to?

A
  • VPCs
  • Subnets
  • Gateways (IGW, VGW, TGW, Outposts local gateway)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What are the default limits of a route table?

A

50 static and 100 dynamic routes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What’s route propagation in the context of AWS VPC’s Route Tables, and what is the maximum number of connections in this context?

A

An option of route tables that allows Virtual Private Gateways (VGW) to dynamically add routes that the VGW learns from an attached VPN connection to it’s associated route table. The maximum number of dynamic routes that can be added via this way is 100 (per route table).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What are the criteria that a route table decides on where to route traffic to (starting with most relevant criteria)?

A
  • Prefix length
  • Static Routes
  • Dynamic Routes (and inside Dynamic Routes: DX > VPN Static > VPN BGP > AS_PATH)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What’s a Gateway route table?

A

A special type of route table that can be assigned to Internet Gateways (IGW), Virtual Private Gateways (VGW) and Transit Gateways (TGW).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

With which network component can you use Accelerated Site-To-Site VPN with?

A

Only with AWS Transit Gateways (TGW), so when creating a TGW VPN attachment.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What costs are associated with using an Accelerated Site-To-Site VPN?

A

What are costs for AWS Site-to-Site VPN connections based on?

  • hours the VPN connection is provisioned ($/h)
  • egress fee ($/GB)
  • hourly fee for the two Global Accelerators
  • accelerator transfer fee for the dominant direction
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What are the two possible attachments for a Site-To-Site VPN?

A
  • Transit Gateway (TGW)

- Virtual Private Gateway (VGW)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What are the bandwidths available for Direct Connect (DX) when provided natively by AWS (so called “Dedicated Connection”)?

A

1, 10 and 100 Gbps (the latter only at selected locations)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What’s a hosted virtual interface (VIF)?

A

It’s a virtual interface type that can be used to share a AWS Direct Connect connection with another AWS account.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What’s the maximum number of VIFs per AWS Direct Connect (DX) connection?

A

50 private/public VIFs + 1 transit VIF

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What’s a Hosted Connection in the context of AWS Direct Connect (DX)?

A

It’s a DX connection provided by a AWS Partner that provides exactly one hosted VIF that a customer can acquire. Bandwidth of that VIF is exclusive to the customer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What are the bandwidths available for AWS Direct Connect (DX) when provided by an AWS Partner?

A

50Mbps - 10Gbps

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What’s important to know about Hosted VIFs when provided by an AWS Partner?

A

Unlike Hosted Connections, Hosted VIFs provided by an AWS Partner share the bandwidth with other Hosted VIFs on that same connection. Therefore, bandwidth could be lower than what’s been ordered/promised.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Are AWS Direct Connect (DX) connections sending data in plain text or encrypted?

A

In plain text, unless additional technologies such as VPN are applied.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What’s a Cross-Connect in the context of AWS Direct Connect (DX)?

A

The physical link between AWS DX router and Customer/Provider DX router inside a DX location. Note: this is NOT the physical connection between DX location and on-premise location.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Can Link Aggregation Groups (LAGs) use connections of different speeds?

A

No. All connections must have the same speed.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What’s the primary purpose of Link Aggregation Groups (LAGs)?

A

Speed. And NOT resilience (even though that they do improve certain resilience aspects of the architecture).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What’s the ‘minimumLink’ attribute used for within the context of Link Aggregation Groups (LAGs)?

A

It defines the minimum of healthy connections, at which the LAG is still considered healthy. For instance, with a LAG of 4 DX connections and a minimumLink of, the LAG is still healthy with only 2 DX connections.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What’s the maximum number of Virtual Private Gateways (VGW) per DX Gateway and can it be increased?

A

10
Cannot be increased

https://docs.aws.amazon.com/directconnect/latest/UserGuide/limits.html

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Do Virtual Private Gateways (VGWs) support inter-VPC-routing?

A

No

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What’s the maximum number of DX Gateways supported per DX Connection?

A

50

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

What are valid targets for an Application Load Balancer?

A

Target groups operating on HTTP/HTTPS level, using the following target types:

  • EC2 instances (incl. ECS-provided instances)
  • IP addresses
  • Lambda functions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Can an internet-facing ELB communicate with EC2 instances from private or public subnets, or both?

A

Both (so also instances in private subnets are accessible for the ELB)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

What’s an Interface Endpoint attached to?

A

A specific subnet, as an ENI (so they are not highly available by default!)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

What’s a Gateway Endpoint attached to?

A

A VPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

What protocols do Interface Endpoints support?

A

IPv4 traffic over TCP only

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

How can you restrict access to an Interface Endpoint?

A

Via Endpoint Policy and via Security Groups (as it’s an ENI)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

What’s the maximum single-flow network performance EC2 instances can communicate with each other in a Cluster Placement Group?

A

10 Gbps (vs. the 5 Gbps you’d have normally)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

What are limitations (i.e. things to look out for) when creating Cluster Placement Groups?

A
  • All EC2 instances must reside in the same AZ
  • Requires a supported instance type
  • All instances should be of the same type and started at the same time
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

What’s the maximum number of instances in a single AZ when using Spread Placement Groups?

A

7

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

What tenant options can you use for Spread Placement Groups?

A

Shared only. “Dedicated Instance” or “Dedicated Host” are not supported with Spread Placement Groups.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

What’s the maximum number of partitions in a single AZ when using Partition Placement Groups?

A

7

48
Q

What’s the maximum number of instances in a single AZ when using Partition Placement Groups?

A

There is no explicit limit. Instead the same limit applies as when not using any Placement Group at all (so just limited by the max. number of currently free instances in that AZ),

49
Q

For which type of workloads are Partition Placement Groups ideal?

A

Large, distributed and replicated workloads, such as Apache’s HDFS (file system), HBase, and Cassandra (both NoSQL DBs). Ideally, topology-aware workloads/applications.

50
Q

What’s the largest CIDR range allowed in a VPC?

A

/16

51
Q

Are NAT Gateways deployed into a VPC, or into the subnet of a VPC? Are they highly available?

A

Into PUBLIC subnet(s), so they are not resilient to AZ-failures. They are however highly-available inside an AZ, which makes them more reliable than NAT Instances.

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-comparison.html

52
Q

802.1Q is a networking standard used for what?

A

Virtual LANs (VLANs) - used often in company networks, but also in AWS, to isolate networks

53
Q

802.1AD is a networking standard used for what?

A

Nested QinQ VLANs - used often by service providers, extending the VLAN standard (802.1Q)

54
Q

For an Ethernet frame, what’s the payload size in bytes from which on a frame is considered a “jumbo” frame, and what’s the max. size of a jumbo frame’s payload?

A

> 1500 bytes

Max.: 9000 bytes

55
Q

Which of the following does/does not support jumbo frames?

1) Traffic outside of a single VPC
2) Traffic over an inter-region VPC peering connection
3) .. same region peering
4) Traffic over VPN connections
5) Traffic over an internet gateway
6) Direct Connect
7) Transit Gateway

A

1) no
2) no
3) yes
4) no
5) no
6) yes
7) yes, up to 8500 bytes

56
Q

What’s IKE Phase 1 used for in the context of IPSec VPN?

A

Initial phase of an IPSec VPN connection where symmetric keys are exchanged via an asymmetric encryption - results in a “phase 1 tunnel” that stays open

57
Q

What’s IKE Phase 2 used for in the context of IPSec VPN?

A

Second phase of an IPSec VPN connection where parties agree on an encryption method and a new set of keys that’s used for the bulk data transfer - results in a “phase 2” tunnel that is used for the actual data transfer - phase 2 tunnel is torn down again when no more “interesting traffic” occurs

58
Q

When having a Client VPN set up, what do you need to do to avoid that traffic between local clients, and from local clients to the internet, aren’t routed via the Client VPN Endpoint?

A

You must enable a “Split Tunnel” on the Client VPN endpoint, so that the Client VPN routes are merely added to the existing ones, rather than replacing them.

59
Q

What’s the difference between Private and Public VIFs?

A

Private VIFs connect to private AWS resources such as a Virtual Private Gateway. Public VIFs connect to public AWS resources such as S3 or SQS, or resources with a public IP addressing.

60
Q

What’s the physical medium that Direct Connect runs over?

A

Fiber (no copper!)

61
Q

What’s the Ethernet standard required for a transceiver to support a 1 Gbp/s Direct Connect connection?

A

1000BASE-LX

62
Q

What’s the Ethernet standard required for a transceiver to support a 10 Gbp/s Direct Connect connection?

A

10GBASE-LR

63
Q

What’s the Ethernet standard required for a transceiver to support a 100 Gbp/s Direct Connect connection?

A

100GBASE-LR4

64
Q

What do you need to configure regarding the following attributes on Direct Connect ports to ensure proper function?

  • Auto-Negotiation
  • Port speed
  • Full-Duplex
A
  • Auto-Negotiation: disabled
  • Port speed: manually set
  • Full-Duplex: manually set
65
Q

What’s MACSec and what problem does it solve in the context of Direct Connect?

A

It’s an ethernet standard that enables encryption of frames between two switches/routers, specifically with AWS Direct Connect, encryption between on-prem router and DX Location AWS cage router.

The two problems/benefits it has are:

  • Layer 2/3 Confidentiality and integrity: secures Ethernet link, incl. Layer 2 packages such as ARP & DHCP, and Layer 3 routing protocols like BGP
  • High speed encryption: enables encryption with 10/100 Gbps DX, which would otherwise be difficult to achieve (would require multiple VPN tunnels).
66
Q

What’s a Letter of Authorization Customer Facility Access (LOA-CFA) form used for?

A

It’s a document used to authorize a cross-connect connection between an AWS-cage and the customer or com-provider cage at a Direct Connect location.

67
Q

What’s a VIF referring to in the context of AWS?

A

Virtual Interface

Allows running multiple layer 3 sessions over the same layer 2 connection. Consists of a BGP Peering session + VLAN.

68
Q

What’s transit VIF referring to in the context of AWS?

A

Allow integration between Transit Gateways and Direct Connect.

69
Q

What’s Layer 2 Adjacency?

A

Two network devices that can directly communicate with each other on layer 2, i.e. exchanging frames.

70
Q

What’s BGP peering?

A

Used to exchange network information between two BGP systems.

71
Q

What’s MTU and in which context is it used?

A

Maximum transmission unit = size of the largest protocol data unit (PDU) that can be communicated in a single network layer transaction.

Relates to, but is not identical to maximum frame size of an Ethernet frame. As with Ethernet frame sizes, an MTU larger than 1500 is typically referred to as “Jumbo Frames”.

72
Q

What AWS network components can you associate a private VIF with?

A
  • Virtual Private Gateway (VGW)
  • Direct Connect Gateway

NOT: Transit Gateways (that’s what “transit VIFs” are for)

73
Q

What’s the maximum number of prefixes that can be advertised via private VIFs?

A

100 (hard limit)

Note: if advertising more, the interface will move into an Idle state and won’t be functional.

74
Q

What is an important consideration regarding cross-region functionality when using private VIFs with Virtual Private Gateways?

A

Private VIFs can only connect to VPGs in the same region as the DX location

75
Q

When establishing a IPSec VPN connection, do you have to use a private or public VIF?

A

Public VIF (as the VGW IPs that the connection is established with on the AWS side are public)

76
Q

What’s the maximum number of VPCs you can attach via a single Direct Connect connection using private VIFs and Direct Connect Gateways (when not using any other network component such as Transit Gateways)?

A

1 Private VIF = 1 DX Gateway & 10 VGW per DX Gateway

1 DX can have 50 private VIFs == 50 DX Gateways == 500 VPCs

77
Q

When using Direct Connect (DX) Gateway, can VPCs that are attached to the DX Gateway communicate with each other?

A

No, not by default. This requires either additional networking components such as Transit Gateway, or routing via the Customer Gateway Router (which is not ideal due to performance and resilience reasons).

78
Q

How many Transit Gateways can be attached to a single Direct Connect connection?

A

3 (1 transit VIF per DX connection and 3 TGW per transit VIF)

79
Q

Can you associate a Direct Connect Gateway with private VIFs, public VIFs or transit VIFs at the same time?

A

No. Public VIFs cannot be used with Direct Connect Gateways anyway. And you cannot use a Direct Connect Gateway with private and transit VIFs at the same time.

80
Q

How many physical connections can be aggregated per Link Aggregation Group (LAG) with Direct Connect?

A

2 x 100 Gbps
- or -
4 x < 100 Gbps (10 Gbps, 1 Gbps, etc.)

==> Max: 200 Gbps

81
Q

Do Link Aggregation Groups (LAG) provide improved resilience?

A

Yes, but very limited, so it should not considered for improving resilience. They key advantage is improved performance (with the caveat of admin overhead though).

82
Q

What’s “Connection Draining” and by which AWS resource/service is it used?

A

It’s a mechanism of the Classic Load Balancer that allows in-flight requests to complete even if the target instance is unhealthy or in the process of being deregistered.

The equivalent mechanism for ALB, NLB and GWLB is called “Deregistration Delay”, that is configured on the Target Group level though, not on the LB itself.

83
Q

What’s “Deregistration Delay” and by which AWS resource/service is it used?

A

Allows Application Load Balancers (ALBs), Network Load Balancers (NLBs) and Gateway Load Balancers (GWLBs) to complete in-flight requests even if the target instance is unhealthy or in the process of being deregistered.

The equivalent mechanism for ALB, NLB and GWLB is called “Connection Draining”, that is configured directly on the Load Balancer though, and not via the Target Group.

84
Q

What’s the X-Forwarded-For header being used for in the context of AWS Load Balancing?

A

It’s an HTTP header, used by Classic Load Balancers and Application Load Balancers to ensure that the target is able to identify where a request originated from.

85
Q

What’s the Layer 4 equivalent of an X-Forwarded-For header and in which scenario is it necessary to use it even for HTTP/HTTPS?

A

PROXY Protocol, which is a layer 4 header, supported by Classic Load Balancer and Network Load Balancer. If an unbroken HTTP/HTTPS connection is required, PROXY Protocol has to be used instead of X-Forwarded-For. That’s because adding the X-Forwarded-For header is layer 7 and is possible only by unencrypting the packages, adding the header, and re-encrypting it.

86
Q

What’s the GENEVE protocol and by which AWS service/product is it being used?

A

It’s a network encapsulation protocol used by AWS Gateway Load Balancers.

87
Q

Do VPC Flow Logs capture packet contents, package metadata, or both?

A

Only package metadata

88
Q

To which three elements can VPC Flow Logs be applied?

A

VPC, Subnet, Interface (ENI)

89
Q

Can you use VPC Flow Logs for real-time analysis of network traffic?

A

No, as data is not collected and served in real-time.

90
Q

What’s the sequence for Source & Destination Address, Source & Destination Port numbers, and Protocol in VPC Flow Logs?

A

Example: 2 123456789010 eni-1235b8ca123456789 172.31.16.139 172.31.16.21 20641 22 6 20 4249 1418530010 1418530070 ACCEPT OK

  • Source Address: 172.31.16.139
  • Destination Address: 172.31.16.21
  • Source Port: 20641
  • Destination Port: 22
  • Protocol: 6 (=> TCP)
91
Q

What traffic is explicitly ignored by VPC Flow Logs?

A
  • instance metadata service (169.254.169.254)
  • DHCP
  • Amazon DNS server
  • Amazon Windows license server
92
Q

For which AWS services does AWS Shield Standard provide protection against Layer 3 and Layer 4 DDoS Attacks?

A
  • Route 53

- CloudFront

93
Q

For which AWS services does AWS Shield Advanced provide protection against Layer 3 and Layer 4 DDoS Attacks?

A
  • EC2
  • Elastic Load Balancing (ELB)
  • Global Accelerator

This is in addition to the following services, which are already covered by AWS Shield Standard:

  • CloudFront
  • Route 53
94
Q

What are benefits provided by AWS Shield Advanced as compared to AWS Shield Standard?

A
  • Layer 3 and 4 DDoS protection for additional services
  • Layer 7 protections (HTTP and DNS floods)
  • DDoS Response Team
  • Financial Insurance (if resources scale up due to Shield response)
95
Q

What AWS services does Web Application Firewall (WAF) integrate with?

A
  • Application Load Balancer
  • API Gateway
  • CloudFront
  • AppSync
96
Q

What are common attacks that Web Application Firewall (WAF) protects from?

A

SQL Injections, Cross-Site Scripting

97
Q

What are valid targets for Network Load Balancer?

A

Target groups operating on TCP/TLS/UDP level, using the following target types:

  • EC2 instances
  • IP addresses
  • Application Load Balancer
98
Q

What’s the minimum number of subnets required to create an Elastic Load Balancer?

A

2

99
Q

What’s a Transit Gateway (TGW) Connect attachment?

A

An attachment for Transit Gateway that establishes a connection from the TGW to a third-party virtual appliance (such as SD-WAN appliances).

100
Q

What’s EBS-optimized?

A

A feature that’s available for selected EC2 instance types, delivering dedicated throughput between EC2 and EBS with options between 500 and 4,000 Mbps.

101
Q

What are the two types available for “Enhanced networking” in EC2 and what speeds do they provide?

A
  • Elastic Network Adapter (ENA) - up to 100 Gbps

- Intel 82599 Virtual Function (VF) interface - up to 10 Gbps

102
Q

What problem does a Direct Connect (DX) Gateway solve?

A

Before DX Gateways, DX connections could only established if the DX location and the target Virtual Private Gateway (VPG), along with the attached VPC, were in the same region. DX Gateway instead is a global service and can serve as a hub between DX location and VPGs, so that one DX connection can connect to VPCs in any region.

103
Q

For maximizing network performance between EC2 instances, what are valid options?

A
  • Launch instances in Cluster Placement groups
  • Use bigger instance types
  • Enable Enhanced Networking
  • Enable jumbo frames

Attaching multiple ENIs can also improve network performance, but depending on the instance type, may not bring anything at all. This is why the options above should be preferred.

104
Q

Can you associate a NACL with a VPC, subnet, or both?

A

Both

VPCs come with a default NACL, which is also the NACL that a subnet inside that VPC uses, if no other NACL is assigned to the subnet.

105
Q

What are the two IPv4 address that Amazon’s DNS server is reachable under for a VPC with the CIDR 172.31.0.0/16?

A
  1. 254.169.253

172. 31.0.2 (VPC base address +2)

106
Q

What is the Amazon DNS server IPv4 address for an instance launched in a subnet with CIDR 172.31.80.0/20, that is part of a VPC with CIDR 172.31.0.0/16?

A

172.31.0.2 (VPC base address +2)

Note: alternatively, 169.254.169.253 works as well, but here it’s the VPC-based Amazon DNS server IPv4 address that we’re looking for.

107
Q

When launching an EC2 instance in a non-default VPC, what options are required so that it can receive a public IPv4 address?

A

Two available options:
A) The subnet that the instance is launched in must have the “Auto-assign public IPv4 address” set to true.
B) When configuring the instance’s configuration details during the launch, the “Auto-assign Public IP” option is enabled.

Note: to actually receive the IP, the subnet must also be connected to an IGW.

108
Q

On which level do you enable Sticky Sessions - Load Balancer or Target Group?

A

Depends on the Load Balancer type:

  • for Classic Load Balancer: on the LB-level
  • for other Load Balancers: on the TG-level
109
Q

What’s a “Target Group” used for in EC2?

A

Used in conjunction with Load Balancers. Defines the targets to which the Load Balancer sends traffic to, which can be any of the following:

  • Instances
  • IP addresses
  • Lambda function
  • Application Load Balancer

Note: depending on the protocol used by the Target Group, the Target Group is visible when creating a Load Balancer or not. NLB for instance can use only Target Groups where the protocol is TCP/TLS/UDP.

110
Q

When setting up a VPN, for which VPN type (static or dynamic) do you need to provide a CIDR range?

A

For static VPNs

111
Q

To which VPC component are Internet Gateways (IGWs) attached to and how does this relate to High-Availability?

A

They’re attached directly to the VPC (and not to the subnet for instance). It’s a highly available component that is redundant across AZs, so failure of one or more AZs would not impact the IGW.

112
Q

To which VPC component are NAT Gateways (NGWs) attached to and how does this relate to High-Availability?

A

Like NAT Instances, NAT Gateways are created inside a single subnet. If the AZ that the subnet resides in fails, the NAT Gateway won’t be available anymore. To ensure High-Availability, multiple NAT Gateways are therefore required, spread across different AZs, with routes being set up from the different subnets across those multiple NAT Gateways.

113
Q

What is correct regarding the following on VPC Gateway Endpoints?

  • AZ failure resilience
  • Prefix Lists vs DNS
  • Can be used without application changes
A
  • They’re resilient to AZ failure
  • They use Prefix Lists
  • They can be used without any application changes
114
Q

What is correct regarding the following on VPC Interface Endpoints?

  • AZ failure resilience
  • Prefix Lists vs DNS
  • Can be used without application changes
A
  • They’re NOT resilient to AZ failure by default, but can be made to by placing multiple interface endpoints into different AZs
  • They use DNS
  • They can be used without any application changes, but only if Private DNS is enabled
115
Q

Can you access VPC Interface Endpoints from outside of a VPC? If so, how?

A

Yes, via AWS Site-to-Site VPN or AWS Direct Connect

116
Q

How many VGWs can you attach to a single VPC at a time?

A

1

117
Q

What are ENI, ENA and EFA and how do they differ from each other in terms of network speed, IO performance, latency, CPU and the ideal use case?

A

ENI (Elastic Network Interface) is the default network adapter (Elastic Network Interface) for any EC2 instance and other VPC components such as PrivateLink, providing up to 10 Gbp/s, suited for general purposes.

ENA (Elastic Network Adapter) is an enhanced networking option using single root I/O virtualization (SR-IOV). It provides higher network speed and I/O performance, lower CPU utilization and lower (and consistent) latencies. Available only on supported instance types, enabled by default on Nitro instances. Note: an alternative to ENA is “Intel 82599 VF interface”, which is considerably slower though, but using the same technique (SR-IOV).

EFA (Elastic Fabric Adapter) is ENA with added capabilities. It further improves network speed, I/O performance and latencies. Behind the scenes, EFA uses OS-bypass capabilities, which makes it ideal for High Performance Computing (HPC) and machine learning applications.

https: //docs.aws.amazon.com/vpc/latest/userguide/VPC_ElasticNetworkInterfaces.html
https: //docs.aws.amazon.com/AWSEC2/latest/UserGuide/efa.html
https: //docs.aws.amazon.com/AWSEC2/latest/UserGuide/enhanced-networking.html
https: //docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/enhanced-networking.html

AWS (16 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions